| Easy Pick |
[Click to reveal]#include "pch.h"
#include "MinHook.h"
#include <iostream>
#include <Windows.h>
#include <string>
using namespace std;
typedef struct lua_State lua_State;
typedef int (*luaL_loadbuffex)(lua_State* L, const char* buffer, size_t sz, const char* name, const char* mode);
lua_State* g_lua_state = nullptr;
luaL_loadbuffex g_luaL_loadbufferx = nullptr;
int __fastcall hkLuaLLoadbufferx(lua_State* L, const char* buffer, size_t sz, const char* name, const char* mode) {
if (name && strstr(name, "main.lua") && strlen(name) <= 10) {
string buff = buffer;
size_t pos1 = buff.find("local p");
size_t pos2 = buff.find('\n', pos1);
if (pos1 != string::npos && pos2 != string::npos) {
buff = buff.substr(0, pos1) + "local p = 9500\n" + buff.substr(pos2+1);
MessageBoxA(NULL, ("Заменено:\n" + buff).c_str(), name, MB_OK | MB_ICONINFORMATION);
return g_luaL_loadbufferx(L, buff.c_str(), buff.size(), name, mode);
}
}
return g_luaL_loadbufferx(L, buffer, sz, name, mode);
}
DWORD WINAPI ConsoleThread(LPVOID) {
setlocale(LC_ALL, "RU");
cout << "[+] Заинжекчено!" << endl;
while (true) Sleep(1000);
return 0;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
MH_Initialize();
HMODULE hMod = GetModuleHandleA(NULL);
void* target = (void*)GetProcAddress(hMod, "luaL_loadbufferx");
if (target != 0) {
if (MH_CreateHook(target, &hkLuaLLoadbufferx, reinterpret_cast<LPVOID*>(&g_luaL_loadbufferx)) == MH_OK) {
MH_EnableHook(target);
CreateThread(NULL, 0, ConsoleThread, NULL, NULL, 0);
}
}
}
else if (ul_reason_for_call = DLL_PROCESS_DETACH) {
MH_Uninitialize();
}
return TRUE;
}
|
2026-10-20 15:34 |